Apparatus and method for detecting and correcting failures in kiosks and informational displays

Abstract

In a kiosk or informational display, an apparatus for detecting and remediating problems, failures, and anomalies includes a data collection agent configured to collect original data over time associated with components, operation, and configuration of the managed computer system, a monitoring and learning module configured to process the original data and generate a historic record that includes time-based data, such as one or more time-based lists, an alert detection system that includes a sensor having associated therewith one of the time-based lists. The sensor is activated when sensor condition(s) are met, which includes evaluating the sensor condition(s) using at least the time-based list and a current-time value of the components, operation, and configuration of the managed computer system. The apparatus includes a remediation action module configured to effect at least one of a plurality of predetermined actions when the sensor is activated.

What is claimed is: 
     
       1. An apparatus for detecting and remediating an anomaly in a computer system, the computer system comprising one of
 (i) an informational display having a display output but having no user input functionality and 
 (ii) a kiosk having an interface that allows the user to interact with the kiosk but which has functionality that precludes the user from changing the purpose of the kiosk, the apparatus comprising: 
 
       a data collection agent configured to collect data over time associated with at least one of:
 components, 
 hardware, 
 software, 
 operation, 
 performance, and 
 configuration of the computer system; 
 
       a monitoring module configured
 to process said data; 
 
       an alert detection system comprising
 at least one sensor being configured to be set to an activated state when sensor conditions associated with said sensor are met to thereby detect said anomaly, said at least one sensor being configured to determine when at least one of said sensor conditions is met 
 by evaluating said data and a value of at least one of the components, hardware, software, operation, performance, and configuration of the computer system; and 
 
       a remediation action module configured to execute on the computer system and to affect at least one of a plurality of actions when said at least one sensor is activated. 
     
     
       2. The apparatus of  claim 1 , wherein said data collection agent is further configured to process said data according to a first-level analytics strategy to output modified data. 
     
     
       3. The apparatus of  claim 2 , wherein said modified data comprises one of a user input activity level as a function of time, a network activity level as a function of time, a central processing unit (CPU) utilization as a function of time, a memory usage as a function of time, and an input/output (I/O) activity as a function of time. 
     
     
       4. The apparatus of  claim 3 , wherein said monitoring module is configured to determine and record user input activity levels as a function of (i) a day-of-the-week and (ii) a respective time-of-day for each day-of-the-week, and wherein one or more sensor conditions comprise determining when a current user input activity level that is associated with (i) a current day-of-the-week and (ii) a current time-of-day varies by at least a predetermined amount from the determined and recorded user input activity level for a corresponding prior day-of-the-week and time-of-day. 
     
     
       5. The apparatus of  claim 4 , wherein said monitoring module is configured to determine said user input activity level with respect to a plurality of day-of-the-week and time-of-day intervals that are prior in time with respect to said current day-of-the-week and said current time-of-day. 
     
     
       6. The apparatus of  claim 3 , wherein said monitoring module is configured to determine and record network traffic levels as a function of (i) a day-of-the-week and (ii) a respective time-of-day for each day-of-the-week, and wherein one or more sensor conditions associated with said at least one sensor comprises determining when a current network activity level that is associated with (i) a current day-of-the-week and (ii) a current time-of-day varies by at least a predetermined amount from the determined and recorded network traffic level for a corresponding prior day-of-the-week and time-of-day. 
     
     
       7. The apparatus of  claim 2 , further comprising a condenser module associated with said computer system that is configured to transmit at least a portion of said data, said modified data, and an activated sensor event to a condensed data store associated with a master computer system, wherein said data, said modified data, and said activated sensor event define condensed data contained in said condensed data store. 
     
     
       8. The apparatus of  claim 7 , wherein said computer system is a first computer system and said data collection agent, said condenser module, said monitoring module, said alert detection system, and said remediation action module respectively comprise a first data collection agent, a first condenser module, a first monitoring module, a first alert detection system, and a first remediation module, said apparatus further comprising a second data collection agent, a second condenser module, a second monitoring module, a second alert detection system, and a second remediation action module all associated with a second computer system, said second condenser module being configured to transfer data, modified data, and an activated sensor event associated with said second computer system to said condensed data store, said apparatus further comprising:
 an analysis module in said master computer system configured to process condensed data originating with said first and second computer systems. 
 
     
     
       9. The apparatus of  claim 8 , wherein said analysis module is configured to produce a multi-device output representative of at least one activated sensor event associated with said first and second computer systems. 
     
     
       10. The apparatus of  claim 1 , wherein said monitoring module is configured to determine and record all devices currently plugged into the computer system and to determine and record all devices that have been removed from the computer system, said monitoring module is configured to determine and record a respective currently-plugged in status time-stamp indicating a date and a time that the status of the devices last changed, and a respective removed time-stamp indicating a date and a time that such devices were-removed from the computer system. 
     
     
       11. The apparatus of  claim 10 , wherein said sensor conditions include determining a number of devices (i) that are universal serial bus (USB) devices and (ii) that have been removed from the computer system between a first predetermined lookback time and a second predetermined lookback time, and wherein said at least one sensor is configured to be activated when said number is greater than zero. 
     
     
       12. The apparatus of  claim 1 , wherein said monitoring module generates a focused application window table, and wherein said monitoring module is configured to determine entries in said focused application window table such that each entry includes a respective application window identification and a related accumulated amount of time that an application window has had focus. 
     
     
       13. The apparatus of  claim 12 , wherein said at least one sensor is configured to compare (i) a first identification corresponding to an identification of the application window from the focused window table that has the highest accumulated time with focus, and (ii) a second identification corresponding to an identification of a current application window of the computer system that has focus, a sensor condition being whether said first identification and said second identification do not match, and wherein said at least one sensor is configured to be activated when said sensor condition is satisfied. 
     
     
       14. The apparatus of  claim 1 , wherein said monitoring module comprises a focused application window table and a currently running application table, and wherein said monitoring module is configured to determine entries in said focused application window table such that each entry includes a respective application window identification and a related accumulated amount of time that said application window has had focus, said monitoring module being further configured to determine entries in said currently running application table such that each entry identifies a respective application that is running on the computer system. 
     
     
       15. The apparatus of  claim 14 , wherein said at least one sensor is configured to determine, from the focused application window table, a first identification which identifies application windows having a highest accumulated amount of time as a first identified application, a sensor condition being whether said first identified application appears in said currently running application table, and wherein said at least one sensor is configured to be activated when said sensor condition is not satisfied. 
     
     
       16. The apparatus of  claim 1 , wherein said at least one of said actions includes (1) a restart of an application; (2) a reboot of an operating system; (3) a restart of the computer system; (4) a reset of a network adapter; (5) a reset of a device attached to said computer system; (6) a restart of a software service on said computer system; or (7) a notification being sent to a predetermined destination. 
     
     
       17. The apparatus of  claim 16 , wherein said remediation action module comprises at least one of a script and a program configured to perform said at least one of said actions. 
     
     
       18. The apparatus of  claim 1 , wherein said monitoring module is configured to determine entries in a currently running application table wherein each entry includes a respective identification of an application and a related application owner name. 
     
     
       19. The apparatus of  claim 18 , wherein said at least one sensor is configured to determine a current focused foreground application and to further determine, using said currently running application table, the application owner name thereof, a sensor condition being whether said determined application owner name matches an operating system owner name, and wherein said sensor is activated when said sensor condition is satisfied. 
     
     
       20. The apparatus of  claim 1 , wherein said alert detection system comprising at least one sensor is configured independently of an application program executing on the computer system whose data of which is being collected by said data collection agent and processed by said monitoring module.